<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv=Content-Type content="text/html; charset=iso-8859-1"> <meta name=Generator content="Microsoft Word 12 (filtered medium)"> <style>  </style>  </head> <body lang=IS link=blue vlink=purple> <div class=Section1> Thanks... ..I have however SUDO schema for LDAP allready. But I cant seam to figure out how to allow certain users to login as other users.. L<o:p></o:p> <o:p> </o:p> Should I just allow the users to do su - ... but then they can login as root also right ?..<o:p></o:p> <o:p> </o:p> This is my sudo schema<o:p></o:p> <o:p> </o:p> dn: cn=schema<o:p></o:p> attributeTypes: ( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' )<o:p></o:p> attributeTypes: ( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' )<o:p></o:p> attributeTypes: ( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Command(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' )<o:p></o:p> attributeTypes: ( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' )<o:p></o:p> attributeTypes: ( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Options(s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' )<o:p></o:p> objectClasses: ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' SUP top STRUCTURAL DESC 'Sudoer Entries' MUST ( cn ) MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoOption $ description ) X-ORIGIN 'SUDO' )<o:p></o:p> <o:p> </o:p> <o:p> </o:p> Regards<o:p></o:p> Siggi<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <div> <div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'> From: fedora-directory-users-bounces@redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of FAUCONNIER Valery AWL-IT Sent: 7. maí 2008 06:31 To: General discussion list for the Fedora Directory server project. Subject: RE: [Fedora-directory-users] Usermod<o:p></o:p> </div> </div> <o:p> </o:p> <div> There is a schema for sudo entries look at <a href="http://fci.wikia.com/wiki/Setting_Up_A_Centralised_Authentication_Server_With_Sudo_Access_Using_LDAP">http://fci.wikia.com/wiki/Setting_Up_A_Centralised_Authentication_Server_With_Sudo_Access_Using_LDAP</a><o:p></o:p> </div> <div> <o:p></o:p> </div> <div> You have to modify the given shema to be compatible with fds (a script exists to convert schema):<o:p></o:p> </div> <div> <o:p></o:p> </div> <div> # cat 77sudo.ldif # ################################################################################ # dn: cn=schema # ################################################################################ # attributeTypes: ( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) # ################################################################################ # attributeTypes: ( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) # ################################################################################ # attributeTypes: ( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Command(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) # ################################################################################ # attributeTypes: ( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s) impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) # ################################################################################ # attributeTypes: ( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 'Options(s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) # ################################################################################ # objectClasses: ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' DESC 'Sudoer Entries' SUP top STRUCTURAL MUST ( cn ) MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoOption $ description ) ) # ################################################################################ #<o:p></o:p> </div> <blockquote style='margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt'> -----Original Message----- From: fedora-directory-users-bounces@redhat.com [mailto:fedora-directory-users-bounces@redhat.com]On Behalf Of Sigurđur Bjarnason Sent: Monday 5 May 2008 18:33 To: Fedora-directory-users@redhat.com Subject: [Fedora-directory-users] Usermod<o:p></o:p> Hi All<o:p></o:p> <o:p> </o:p> Is there any way of defineing usermod with FDS ?, <o:p></o:p> <o:p> </o:p> Lets say that I am user „siggi“ and I need to give him rights to login as user „test“ is that possible with FDS ?<o:p></o:p> <o:p> </o:p> Regards<o:p></o:p> Siggi<o:p></o:p> <o:p> </o:p> </blockquote> Atos Worldline SA/NV - Chaussee de Haecht 1442 Haachtsesteenweg <o:p></o:p> - 1130 Brussels - Belgium<o:p></o:p> RPM-RPR Bruxelles-Brussel - TVA-BTW BE 0418.547.872<o:p></o:p> Bankrekening-Compte Bancaire-Bank Account 310-0269424-44<o:p></o:p> BIC BBRUBEBB - IBAN BE55 3100 2694 2444<o:p></o:p> <o:p></o:p> "The information contained in this e-mail and any attachment thereto is confidential and may contain information which is protected by intellectual property rights.<o:p></o:p> This information is intended for the exclusive use of the recipient(s) named above.<o:p></o:p> This e-mail does not constitute any binding relationship or offer toward any of the addressees.<o:p></o:p> If you are not one of the addressees , one of their employees or a proxy holder entitled to hand over this message to the addressee(s), any use of the information contained herein (e.g. reproduction, divulgation, communication or distribution,...) is prohibited.<o:p></o:p> If you have received this message in error, please notify the sender and destroy it immediately after.<o:p></o:p> The integrity and security of this message cannot be guaranteed and it may be subject to data corruption, interception and unauthorized amendment, for which we accept no liability."<o:p></o:p> </div> </body> </html>